# Data Processing Addendum (draft)

_Last updated: 2026-10-31. Draft for counsel review._

This DPA applies when crwl processes personal data on your behalf.

## 1. Roles and scope

You are controller; crwl is processor. Processing covers: receiving search filters, querying
subprocessors, returning and briefly caching contact rows.

## 2. Instructions

Documented API behaviour is the instruction set. crwl may use subprocessors under
`subprocessors.md`; changes get 14 days' notice, and you may object.

## 3. Security measures

- TLS 1.2+ in transit; keys hashed (SHA-256) at rest
- Tenant-scoped keys with read/write scopes
- Per-tenant rate and spend limits
- Least-privilege host access; secrets only in environment
- Nightly retention sweep; 24 h job and cache lifetime

## 4. Subprocessors and transfers

Listed in `subprocessors.md`. Where required, transfers rely on the EU SCCs (2021 modules).

## 5. Assistance

crwl assists with data-subject requests, DPIAs and breach notification within 72 h of becoming aware.
Breach notices include scope, likely impact and remediation.

## 6. Deletion and return

On termination, account data is deleted within 30 days. Append-only cost ledgers may be retained in
minimised form. Export is available through the API while the account is active.

## 7. Audit

An annual self-assessment summary is available on request. On-site audits by arrangement.